1 Billion Yahoo Accounts Hacked: Full Story

Yes, a single data breach in 2013 compromised all roughly 3 billion Yahoo user accounts, not just 1 billion. The company confirmed this in 2017, making it the largest known data breach of a single company in history. This article explains what happened, what data was taken, how Yahoo responded, and what you can do to protect yourself.

Background: The 2013 Breach and Its Discovery

In August 2013, hackers stole data belonging to virtually every Yahoo account that existed at the time. The company initially disclosed the breach in December 2016, stating that about 1 billion accounts were affected. However, in October 2017, Yahoo revised that number to 3 billion — meaning every single Yahoo account was exposed. The breach was discovered only after Yahoo had been acquired by Verizon, which later merged Yahoo with AOL to form Oath, now part of the company known as Altaba.

The identity of the attackers was never officially confirmed, but the U.S. Department of Justice indicted two Russian intelligence officers and two hackers in 2017, linking them to the breach. The stolen data included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5), and in some cases, unencrypted security questions and answers. This made the breach particularly dangerous because security questions were often used for account recovery.

How the Attack Happened

The exact method of the 2013 intrusion was not fully disclosed, but it is believed to have involved a spear-phishing campaign that tricked Yahoo employees into handing over credentials. Once inside, the attackers accessed the user database and copied it. The stolen data was then used to create a forged cookie that allowed the attackers to access accounts without a password. This technique was also used in a separate 2014 breach that affected 500 million accounts, where the attackers used forged cookies to break into accounts.

Yahoo’s use of MD5 hashing — an old and weak algorithm — without salt (random data added to passwords before hashing) made it easier for attackers to crack many passwords. MD5 is fast to compute, so hackers could test billions of password guesses per second. In contrast, modern systems use slow, salted hashing algorithms like bcrypt or PBKDF2.

Yahoo’s Response and Legal Fallout

Yahoo’s handling of the breach was heavily criticized. The company discovered the breach in 2014 but did not disclose it until 2016, partly because the investigation was ongoing and partly because the company was in the middle of selling its core business to Verizon. This delay led to lawsuits, and Verizon eventually negotiated a $350 million reduction in the purchase price.

In 2018, Yahoo agreed to pay $50 million to victims of the breach as part of a class-action settlement, plus $35 million for shareholder claims. The settlement provided affected users with two years of free credit monitoring, though the stolen data did not include financial information. Yahoo also faced penalties from the U.S. Securities and Exchange Commission (SEC) for failing to disclose the breach to investors in a timely manner.

What Data Was Stolen and What It Means

The stolen data varied by account but generally included:

• Names and email addresses
• Telephone numbers and dates of birth
• Hashed passwords (MD5)
• Security questions and answers (some unencrypted)
• IP addresses and browser information

Because security questions were exposed, attackers could answer them to reset passwords on other services if the user reused the same questions. Even if you changed your Yahoo password after the breach, any other account using the same email address or security questions was at risk. The stolen data was also used in credential stuffing attacks, where hackers try the same email/password combination on other websites.

How to Check If You Were Affected

Yahoo forced all affected users to change their passwords and invalidated unencrypted security questions. The company also required users to change their passwords if they had not done so since 2014. If you had a Yahoo account at any time before 2016, you were almost certainly affected. To check if your Yahoo account was part of the breach, you can:

1. Log in to your Yahoo account and look for a notification about the breach.
2. Visit haveibeenpwned.com and enter your Yahoo email address to see if it appears in the breach dataset.
3. Check your email for a message from Yahoo about the breach, though many users never received one.

What to Do Now

Even if you haven’t used your Yahoo account in years, you should take these steps:

• Change your Yahoo password immediately and use a unique, complex password.
• Enable two-factor authentication (2FA) on your Yahoo account to add an extra layer of security.
• If you reused the same password or security questions elsewhere, change those as well.
• Be wary of phishing emails that reference the breach — scammers often use major incidents to trick people into clicking malicious links.
• Consider deleting your Yahoo account if you no longer use it, to reduce your exposure.

Frequently Asked Questions

Was my Yahoo account affected? If you had a Yahoo account at any time before 2016, it was almost certainly included in the breach. Yahoo confirmed that all 3 billion accounts were exposed.

Should I still worry if I changed my password after the breach? Yes, because the stolen data included security questions and answers, which are harder to change. If you reused those questions elsewhere, those accounts are at risk. Also, the breach data is still circulating, so attackers may try to use it for credential stuffing.

Did the breach include my credit card or bank details? No, Yahoo stated that the stolen data did not include financial information like credit card numbers or bank account details. However, the data did include dates of birth and phone numbers, which can be used for identity theft.

How can I tell if my password was cracked? You can’t directly check, but if you used a weak or common password, it was likely cracked quickly. Use a password manager to generate and store strong, unique passwords for each account.

Is Yahoo still safe to use? Yahoo has since improved its security, but the company’s track record is concerning. If you use Yahoo, enable 2FA and use a strong, unique password. Consider switching to a more secure email provider if you’re worried.

What happened to the hackers? The U.S. Department of Justice indicted two Russian intelligence officers and two hackers in 2017, but they remain at large. No one has been convicted in connection with the breach.

Related

• Create New Service Units in systemd?
• Obsidian Plugin Deletes Work: Fixes & Data Recovery
• Insightful Strike in Where Winds Meet: Location & Best Uses